feat(auth): add upstream OIDC preflight check and staging validation overlay

README.md

@@ -30,13 +30,13 @@
 
 <!-- ATLAS-MODELS:START lang=en campaign=mcp-server -->
 <!-- ⚠️ Auto-generated from the live model catalog by AtlasCloudAI/.github/scripts/update-models-readme.mjs — do not edit by hand. -->
-- 🎬 **Video** (186) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Wan 2.7 Spicy · Seedance 2.0 Mini · HappyHorse-1.1
-- 🎨 **Image** (117) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
+- 🎬 **Video** (174) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Seedance 2.0 Mini · HappyHorse-1.1 · Gemini Omni Flash
+- 🎨 **Image** (116) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
 - 🧊 **3D** (7) — Seed3D 2.0 · Hunyuan 3D Rapid · Hunyuan 3D Pro · Tripo H3.1
-- 💬 **LLM** (62) — DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3 · Grok 4.5
+- 💬 **LLM** (64) — Grok 4.6 · DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3
 - 🔊 **Audio (TTS · Music · ASR)** (18) — Seed Audio 1.0 · xAI TTS v1 · ElevenLabs v3 · Suno chirp-v4-5-all
 
-- 📚 **Explore more** — [all 407 live models »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
+- 📚 **Explore more** — [all 395 live models »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
 <!-- ATLAS-MODELS:END -->
 
 ## Contents

deploy/kubernetes/README.md

@@ -47,7 +47,7 @@ Staging uses the longest OAuth lifetimes accepted by the current auth config:
 | Credential | Lifetime | Behavior |
 |---|---:|---|
 | Access token | 3,600 seconds (1 hour) | Short-lived bearer token |
-| Refresh token | 604,800 seconds (7 days) | Rotated on refresh; the consumed token allows at most 2 retries inside a fixed 30-second window, then strict replay detection resumes |
+| Refresh token | 7,776,000 seconds (90 days) | Independent from the 8-hour browser session and rotated on refresh; the consumed token allows at most 2 retries inside a fixed 30-second window, then strict replay detection resumes |
 | Authorization grant | 31,536,000 seconds (1 year) | Upper bound for an actively refreshed connection; must not be shorter than the refresh-token lifetime |
 | Dynamic public client (ChatGPT or Codex) | 31,536,000 seconds (1 year) | Re-registration is normally unnecessary during this period |
 
@@ -197,6 +197,21 @@ Register this exact upstream callback URL with the identity provider:
 https://mcp-auth.atlascloud.ai/upstream/callback
 ```
 
+`docs/UPSTREAM_OIDC_REQUIREMENTS.md` states every rule the provider must
+satisfy. Confirm a candidate issuer before requesting DNS, secrets, or a
+deployment window; the check needs no build step, client secret, or cluster
+access:
+
+```bash
+node scripts/check-upstream-oidc.mjs https://issuer.example.com
+```
+
+It prints one `PASS`/`FAIL` line per rule plus the exact
+`AUTH_UPSTREAM_ENDPOINT_HOSTS` value implied by the discovery document, and
+exits non-zero on failure. `email_verified: true` in the ID token is the one
+mandatory behavior discovery cannot prove; confirm it with the provider
+directly.
+
 Create these additional Kubernetes Secret keys out of band:
 
 - `generation-confirmation-secret`: at least 32 random bytes, shared by every
@@ -252,3 +267,25 @@ The directory is intentionally named `.example`; do not apply the rendered
 output until every external production gate above is satisfied. Both staging
 and production reuse the single reviewed manifest in `base/staging.yaml`, so
 there is no duplicated deployment source to drift.
+
+### Validating upstream OIDC on staging first
+
+`staging-upstream-oidc.example/` applies the production identity and credential
+profile to the staging hosts: `AUTH_IDENTITY_MODE=upstream-oidc`,
+`MCP_CREDENTIAL_MODE=redis-subject-map`, the encrypted credential keyring, and
+removal of `OIDC_USERS_JSON` and `MCP_ATLAS_SUBJECT_KEYS_JSON`. It keeps
+`PLUGIN_RELEASE_TIER=staging`, so a staging-labeled upstream issuer is accepted
+there and rejected by the production gate.
+
+```bash
+kubectl kustomize deploy/kubernetes/staging-upstream-oidc.example
+```
+
+It reads the same additional Secret keys as production, so populate
+`auth-upstream-*` and `credential-encryption-keys-json` in
+`mcp-servers/atlascloud-openai-plugin` before applying, and register the
+staging Auth callback with the provider. This overlay retires the reviewer
+password path on staging: `scripts/codex-oauth-e2e.mjs` and
+`npm run test:codex-oauth:chrome-live` both read a reviewer password from stdin
+and cannot drive an upstream sign-in, so validate the browser flow manually
+while it is active.

deploy/kubernetes/base/staging.yaml

@@ -139,7 +139,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: mcp
-          image: registry.atlascloud.ai/vcv-dg/atlascloud-mcp-openai-plugin@sha256:2cb3bd9c811403d1eb7649635f184e0bb9a5e44c3ef320e2a2ffc24efa8a79ff
+          image: registry.atlascloud.ai/vcv-dg/atlascloud-mcp-openai-plugin@sha256:bdcbd38822b2ff02f05b74ed510d2ebc49d022f88d4960e87178f74677cbe5f0
           imagePullPolicy: IfNotPresent
           args: ["node", "dist/http.js"]
           securityContext:
@@ -290,7 +290,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: auth
-          image: registry.atlascloud.ai/vcv-dg/atlascloud-mcp-openai-plugin@sha256:2cb3bd9c811403d1eb7649635f184e0bb9a5e44c3ef320e2a2ffc24efa8a79ff
+          image: registry.atlascloud.ai/vcv-dg/atlascloud-mcp-openai-plugin@sha256:5b9a71a5699980145eb9d1641085aa79c89cf28bfec299f3c0087a0267082d5a
           imagePullPolicy: IfNotPresent
           args: ["node", "dist/auth.js"]
           securityContext:
@@ -325,7 +325,7 @@ spec:
             - name: AUTH_ACCESS_TOKEN_TTL_SECONDS
               value: "3600"
             - name: AUTH_REFRESH_TOKEN_TTL_SECONDS
-              value: "604800"
+              value: "7776000"
             - name: AUTH_REFRESH_TOKEN_REUSE_GRACE_SECONDS
               value: "30"
             - name: AUTH_REFRESH_TOKEN_REUSE_MAX_ATTEMPTS

deploy/kubernetes/production.example/production-patch.yaml

@@ -8,7 +8,7 @@ spec:
     spec:
       containers:
         - name: mcp
-          image: registry.atlascloud.ai/vcv-dg/atlascloud-mcp-openai-plugin@sha256:9e3ea858953d01b55eba0a1dce66793c7b5cc19dccb232cd24b4d4aa484022fb
+          image: registry.atlascloud.ai/vcv-dg/atlascloud-mcp-openai-plugin@sha256:5b9a71a5699980145eb9d1641085aa79c89cf28bfec299f3c0087a0267082d5a
           env:
             - name: PLUGIN_RELEASE_TIER
               value: production
@@ -61,7 +61,7 @@ spec:
     spec:
       containers:
         - name: auth
-          image: registry.atlascloud.ai/vcv-dg/atlascloud-mcp-openai-plugin@sha256:9e3ea858953d01b55eba0a1dce66793c7b5cc19dccb232cd24b4d4aa484022fb
+          image: registry.atlascloud.ai/vcv-dg/atlascloud-mcp-openai-plugin@sha256:5b9a71a5699980145eb9d1641085aa79c89cf28bfec299f3c0087a0267082d5a
           env:
             - name: PLUGIN_RELEASE_TIER
               value: production
@@ -97,6 +97,8 @@ spec:
                   key: auth-upstream-endpoint-hosts
             - name: AUTH_ACCESS_TOKEN_TTL_SECONDS
               value: "600"
+            - name: AUTH_REFRESH_TOKEN_TTL_SECONDS
+              value: "7776000"
             - name: AUTH_CREDENTIAL_REDIS_PREFIX
               value: atlascloud:openai-plugin:credential
             - name: AUTH_CREDENTIAL_ENCRYPTION_KEYS_JSON

deploy/kubernetes/staging-upstream-oidc.example/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: staging-upstream-oidc-patch.yaml

deploy/kubernetes/staging-upstream-oidc.example/staging-upstream-oidc-patch.yaml

@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: atlascloud-openai-mcp
+  namespace: mcp-servers
+spec:
+  template:
+    spec:
+      containers:
+        - name: mcp
+          env:
+            - name: MCP_CREDENTIAL_MODE
+              value: redis-subject-map
+            - name: MCP_CREDENTIAL_REDIS_PREFIX
+              value: atlascloud:openai-plugin:credential
+            - name: MCP_CREDENTIAL_ENCRYPTION_KEYS_JSON
+              valueFrom:
+                secretKeyRef:
+                  name: atlascloud-openai-plugin
+                  key: credential-encryption-keys-json
+            - name: MCP_ATLAS_SUBJECT_KEYS_JSON
+              $patch: delete
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: atlascloud-openai-auth
+  namespace: mcp-servers
+spec:
+  template:
+    spec:
+      containers:
+        - name: auth
+          env:
+            - name: AUTH_IDENTITY_MODE
+              value: upstream-oidc
+            - name: AUTH_UPSTREAM_ISSUER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: atlascloud-openai-plugin
+                  key: auth-upstream-issuer-url
+            - name: AUTH_UPSTREAM_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: atlascloud-openai-plugin
+                  key: auth-upstream-client-id
+            - name: AUTH_UPSTREAM_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: atlascloud-openai-plugin
+                  key: auth-upstream-client-secret
+            - name: AUTH_UPSTREAM_SCOPES
+              value: openid,email,profile
+            - name: AUTH_UPSTREAM_ENDPOINT_HOSTS
+              valueFrom:
+                secretKeyRef:
+                  name: atlascloud-openai-plugin
+                  key: auth-upstream-endpoint-hosts
+            - name: AUTH_CREDENTIAL_REDIS_PREFIX
+              value: atlascloud:openai-plugin:credential
+            - name: AUTH_CREDENTIAL_ENCRYPTION_KEYS_JSON
+              valueFrom:
+                secretKeyRef:
+                  name: atlascloud-openai-plugin
+                  key: credential-encryption-keys-json
+            - name: OIDC_USERS_JSON
+              $patch: delete

docs/README.es.md

@@ -30,13 +30,13 @@
 
 <!-- ATLAS-MODELS:START lang=es campaign=mcp-server -->
 <!-- ⚠️ Auto-generated from the live model catalog by AtlasCloudAI/.github/scripts/update-models-readme.mjs — do not edit by hand. -->
-- 🎬 **Vídeo** (186) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Wan 2.7 Spicy · Seedance 2.0 Mini · HappyHorse-1.1
-- 🎨 **Imagen** (117) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
+- 🎬 **Vídeo** (174) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Seedance 2.0 Mini · HappyHorse-1.1 · Gemini Omni Flash
+- 🎨 **Imagen** (116) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
 - 🧊 **3D** (7) — Seed3D 2.0 · Hunyuan 3D Rapid · Hunyuan 3D Pro · Tripo H3.1
-- 💬 **LLM** (62) — DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3 · Grok 4.5
+- 💬 **LLM** (64) — Grok 4.6 · DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3
 - 🔊 **Audio (TTS · Música · ASR)** (18) — Seed Audio 1.0 · xAI TTS v1 · ElevenLabs v3 · Suno chirp-v4-5-all
 
-- 📚 **Explora más** — [los 407 modelos en vivo »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
+- 📚 **Explora más** — [los 395 modelos en vivo »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
 <!-- ATLAS-MODELS:END -->
 
 ## Contenido

docs/README.fr.md

@@ -30,13 +30,13 @@
 
 <!-- ATLAS-MODELS:START lang=fr campaign=mcp-server -->
 <!-- ⚠️ Auto-generated from the live model catalog by AtlasCloudAI/.github/scripts/update-models-readme.mjs — do not edit by hand. -->
-- 🎬 **Vidéo** (186) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Wan 2.7 Spicy · Seedance 2.0 Mini · HappyHorse-1.1
-- 🎨 **Image** (117) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
+- 🎬 **Vidéo** (174) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Seedance 2.0 Mini · HappyHorse-1.1 · Gemini Omni Flash
+- 🎨 **Image** (116) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
 - 🧊 **3D** (7) — Seed3D 2.0 · Hunyuan 3D Rapid · Hunyuan 3D Pro · Tripo H3.1
-- 💬 **LLM** (62) — DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3 · Grok 4.5
+- 💬 **LLM** (64) — Grok 4.6 · DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3
 - 🔊 **Audio (TTS · Musique · ASR)** (18) — Seed Audio 1.0 · xAI TTS v1 · ElevenLabs v3 · Suno chirp-v4-5-all
 
-- 📚 **Explorer plus** — [les 407 modèles en ligne »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
+- 📚 **Explorer plus** — [les 395 modèles en ligne »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
 <!-- ATLAS-MODELS:END -->
 
 ## Sommaire

docs/README.ja.md

@@ -30,13 +30,13 @@
 
 <!-- ATLAS-MODELS:START lang=ja campaign=mcp-server -->
 <!-- ⚠️ Auto-generated from the live model catalog by AtlasCloudAI/.github/scripts/update-models-readme.mjs — do not edit by hand. -->
-- 🎬 **動画** (186) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Wan 2.7 Spicy · Seedance 2.0 Mini · HappyHorse-1.1
-- 🎨 **画像** (117) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
+- 🎬 **動画** (174) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Seedance 2.0 Mini · HappyHorse-1.1 · Gemini Omni Flash
+- 🎨 **画像** (116) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
 - 🧊 **3D** (7) — Seed3D 2.0 · Hunyuan 3D Rapid · Hunyuan 3D Pro · Tripo H3.1
-- 💬 **LLM** (62) — DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3 · Grok 4.5
+- 💬 **LLM** (64) — Grok 4.6 · DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3
 - 🔊 **音声 (TTS · 音楽 · 音声認識)** (18) — Seed Audio 1.0 · xAI TTS v1 · ElevenLabs v3 · Suno chirp-v4-5-all
 
-- 📚 **さらに探す** — [全 407 モデル »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
+- 📚 **さらに探す** — [全 395 モデル »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
 <!-- ATLAS-MODELS:END -->
 
 ## 目次

docs/README.ko.md

@@ -30,13 +30,13 @@
 
 <!-- ATLAS-MODELS:START lang=ko campaign=mcp-server -->
 <!-- ⚠️ Auto-generated from the live model catalog by AtlasCloudAI/.github/scripts/update-models-readme.mjs — do not edit by hand. -->
-- 🎬 **비디오** (186) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Wan 2.7 Spicy · Seedance 2.0 Mini · HappyHorse-1.1
-- 🎨 **이미지** (117) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
+- 🎬 **비디오** (174) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Seedance 2.0 Mini · HappyHorse-1.1 · Gemini Omni Flash
+- 🎨 **이미지** (116) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
 - 🧊 **3D** (7) — Seed3D 2.0 · Hunyuan 3D Rapid · Hunyuan 3D Pro · Tripo H3.1
-- 💬 **LLM** (62) — DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3 · Grok 4.5
+- 💬 **LLM** (64) — Grok 4.6 · DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3
 - 🔊 **오디오 (TTS · 음악 · STT)** (18) — Seed Audio 1.0 · xAI TTS v1 · ElevenLabs v3 · Suno chirp-v4-5-all
 
-- 📚 **더 살펴보기** — [전체 407개 모델 »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
+- 📚 **더 살펴보기** — [전체 395개 모델 »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
 <!-- ATLAS-MODELS:END -->
 
 ## 목차

docs/README.zh-CN.md

@@ -30,13 +30,13 @@
 
 <!-- ATLAS-MODELS:START lang=zh-CN campaign=mcp-server -->
 <!-- ⚠️ Auto-generated from the live model catalog by AtlasCloudAI/.github/scripts/update-models-readme.mjs — do not edit by hand. -->
-- 🎬 **视频** (186) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Wan 2.7 Spicy · Seedance 2.0 Mini · HappyHorse-1.1
-- 🎨 **图片** (117) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
+- 🎬 **视频** (174) — Seedance 2.5 · MiniMax H3 · Youchuan V8.2 · Seedance 2.0 Mini · HappyHorse-1.1 · Gemini Omni Flash
+- 🎨 **图片** (116) — Seedream v5.0 Pro · Qwen Image 3.0 · Reve 2.1 · Youchuan V8.2
 - 🧊 **3D** (7) — Seed3D 2.0 · Hunyuan 3D Rapid · Hunyuan 3D Pro · Tripo H3.1
-- 💬 **大语言模型** (62) — DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3 · Grok 4.5
+- 💬 **大语言模型** (64) — Grok 4.6 · DeepSeek V4 Flash 0731 · Qwen3.8 Max · Kimi K3
 - 🔊 **音频（TTS · 音乐 · 语音识别）** (18) — Seed Audio 1.0 · xAI TTS v1 · ElevenLabs v3 · Suno chirp-v4-5-all
 
-- 📚 **探索更多** — [全部 407 个在线模型 »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
+- 📚 **探索更多** — [全部 395 个在线模型 »](https://www.atlascloud.ai/models?utm_source=github&utm_campaign=mcp-server)
 <!-- ATLAS-MODELS:END -->
 
 ## 目录